Getting Data In

Can someone provide a work example for Splunk HEC using Java Spring Boot?

aa70627
Communicator

Can someone assist with providing a working example on how to use and send data to Splunk HTTP Event Collect (HEC) from a java Spring Boot application? Please provide settings and code used for pom.xml, log4j.xml and code example. We reviewed the example from http://dev.splunk.com/view/splunk-logging-java/SP-CAAAE7M and we're not sure if its applicable to Java spring boot since spring boot automatically loads up its own logger.

our POM file

<?xml version="1.0" encoding="UTF-8"?>
<project xmlns="http://maven.apache.org/POM/4.0.0" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
    xsi:schemaLocation="http://maven.apache.org/POM/4.0.0 http://maven.apache.org/xsd/maven-4.0.0.xsd">;

    <modelVersion>4.0.0</modelVersion>
    <groupId>com.myco</groupId>
    <artifactId>javaapp-network</artifactId>
    <version>0.0.1-SNAPSHOT</version>
    <packaging>jar</packaging>

    <name>javaapp-network</name>
    <description></description>

    <parent>
        <groupId>org.springframework.boot</groupId>
        <artifactId>spring-boot-starter-parent</artifactId>
        <version>2.0.1.RELEASE</version>
        <relativePath/> 
    </parent>

    <properties>
        <project.build.sourceEncoding>UTF-8</project.build.sourceEncoding>
        <project.reporting.outputEncoding>UTF-8</project.reporting.outputEncoding>
        <java.version>1.8</java.version>
        <spring-cloud.version>Finchley.RC1</spring-cloud.version>
    </properties>

    <repositories>

            <repository>
            <id>spring-milestones</id>
            <name>Spring Milestones</name>
            <url>https://repo.spring.io/milestone</url>
            <snapshots>
                <enabled>false</enabled>
            </snapshots>
        </repository>

            <repository>
            <id>spring-plugins</id>
            <name>Spring Plugins</name>
            <url>http://repo.spring.io/plugins-release/</url>
            <snapshots>
                <enabled>false</enabled>
            </snapshots>
        </repository>

     </repositories>

    <dependencies>

        <dependency>
        <groupId>org.apache.logging.log4j</groupId>
        <artifactId>log4j-core</artifactId>
        <version>2.3</version>
    </dependency>

        <dependency>
            <groupId>com.splunk.logging</groupId>
            <artifactId>splunk-library-javalogging</artifactId>
            <version>1.5.3</version>
        </dependency>

        <dependency>
            <groupId>org.springframework.boot</groupId>
            <artifactId>spring-boot-starter-actuator</artifactId>
        </dependency>

        <dependency>
            <groupId>org.springframework.boot</groupId>
            <artifactId>spring-boot-starter-data-mongodb</artifactId>
        </dependency>

        <dependency>
            <groupId>org.springframework.boot</groupId>
            <artifactId>spring-boot-starter-data-rest</artifactId>
        </dependency>

        <dependency>
            <groupId>org.springframework.boot</groupId>
            <artifactId>spring-boot-starter-jersey</artifactId>
        </dependency>

        <dependency>
            <groupId>org.springframework.kafka</groupId>
            <artifactId>spring-kafka</artifactId>
        </dependency>

        <dependency>
            <groupId>org.springframework.boot</groupId>
            <artifactId>spring-boot-starter-actuator</artifactId>
        </dependency>

        <dependency>
            <groupId>org.springframework.boot</groupId>
            <artifactId>spring-boot-starter-test</artifactId>
            <scope>test</scope>
        </dependency>

    </dependencies>

    <build>
        <plugins>
            <plugin>
                <groupId>org.springframework.boot</groupId>
                <artifactId>spring-boot-maven-plugin</artifactId>
            </plugin>
        </plugins>
    </build>

</project>

our log4j2.xml

<Appenders>

    <Socket name="socket" host="server01.myco.com" port="8088">
        <PatternLayout pattern="%p: %m%n" charset="UTF-8"/>
    </Socket>

    <Http name="http-input"
          url="https://server01.myco.com:8088"
          token="C6D6D450-E8CD-4507-8C01-C070A7888924"
          host="server01.myco.com"
          index="javaapp"
          source="splunktest"
          sourcetype="log4j"
          middleware="HttpEventCollectorUnitTestMiddleware"
          batch_size_bytes="0"
          batch_size_count="0"
          batch_interval="0"
          disableCertificateValidation="true">
        <PatternLayout pattern="%m"/>
    </Http>

</Appenders>

<Loggers>
    <Root level="INFO">
    </Root>
    <Logger name="splunk.logger" level="info">
        <AppenderRef ref="socket"/>
    </Logger>

    <Logger name="splunk.log4j" level="info">
        <AppenderRef ref="http-input"/>
    </Logger>

</Loggers>
1 Solution

sindhuja
Loves-to-Learn Lots

Hi ,

I have same example code which looks same but am facing issue 

am unable to see logs in splunk .

do u have any idea

0 Karma

aa70627
Communicator

Thanks !!! Greatly appreciated.

0 Karma

nytins
Engager

@aa70627 Did u manage to find a solution?

0 Karma

aa70627
Communicator

@nytins yes. The one that is highlighted as answer helped me resolve the issue.

0 Karma
Get Updates on the Splunk Community!

.conf25 Registration is OPEN!

Ready. Set. Splunk! Your favorite Splunk user event is back and better than ever. Get ready for more technical ...

Detecting Cross-Channel Fraud with Splunk

This article is the final installment in our three-part series exploring fraud detection techniques using ...

Splunk at Cisco Live 2025: Learning, Innovation, and a Little Bit of Mr. Brightside

Pack your bags (and maybe your dancing shoes)—Cisco Live is heading to San Diego, June 8–12, 2025, and Splunk ...